Hi, we were recently social engineered to give admin to a compromised user. As far as the logs say, he enabled “ Data Explorer ”, and didn’t do anything else except Impersonate a few users. What is the impact of this incident to our forum and is there anything serious?

have you seen this yet? [immagine] What to do if your Discourse is compromised Self-Hosting We’ve recently had two reports of Discourse sites that were compromised, likely due to weak admin account passwords. So we’d like to document: what to do when comprom…

yes but what about preventing a similar social engineering penetration and securing admin?

that’s 100% fault on my end. I have decided just to no longer give admin to anyone, especially not people I haven’t met and trust in real life.

For some more detail: The person that did the data breach got a permanent suspension from the forum because they were never trusted again. [image] The problem is that they could create alternative accounts on that forum and use it to evade their suspension and cause more chaos. Perhaps Blacklist…

Having CSGO in your username could be grounds alone for suspension…

That’s mandatory for every single secure space on internet (because of that some of us likes real private messages -encrypted-).

Social engineering attacks are based on the all-too-human trait of trusting people. And there are some really smooth talkers out there!

They did make alt accounts and once we saw it we perm suspended those accounts as well

why not block his IP too? i’d at least delete an alt account and block the IP.

Because changing IP, if it has been static in the first place, happends faster than banning?

it actually works better than you think. i’ve stopped a number of problem users with it. i find suspension easier to circumvent. also why would you not use all available methods to stop further action from this person?

Amministratore del forum compromesso

Supporto

Lilly 4 Giugno 2023, 1:45pm 45

Hai già visto questo?

Argomento		Risposte	Visualizzazioni
Discourse hacked via sophisticated social engineering Site feedback	9	7352	Maggio 21, 2018
What to do if your Discourse is compromised Self-Hosting reference	0	10349	Febbraio 24, 2016
Is there a way to manually locate user's passwords? Support	23	5170	Ottobre 19, 2021
The Impersonated user should be notified that they are being Impersonated Feature impersonate	21	2336	Maggio 7, 2019
How do other admins deal with compromised accounts? Community Building	9	330	Settembre 16, 2025

Amministratore del forum compromesso

Argomenti correlati